Massad Clipper & Stealer [solution: only download genuine software]

CCleaner for Windows CCleaner Windows Help Requests
1

I cant reach CCleaner staff so I'm posting publicly, what is a situation with Massad Clipper & Stealer and CCleaner supposedly used for transmitting those threads?

2

Are you talking about this ?

https://www.securityweek.com/masad-stealer-uses-telegram-exfiltrate-data

Why do you think CCleaner is involved?

3

as mentioned , I saw some articles talking about it.

I'm surprise that you are not aver of this!? ?

https://www.forbes.com/sites/daveywinder/2019/09/28/post-crash-bitcoin-warning-as-wallets-targeted-in-active-and-ongoing-hack-attack/#e9691173c14e

or

https://forums.juniper.net/t5/Threat-Research/Masad-Stealer-Exfiltrating-using-Telegram/ba-p/468559

4

That is why CCleaner should ONLY be downloaded from the official site and never from third party download sites or on file sharing sites

This apply to all software really.

5

so let me understand this fully. You are saying that it is only "by lowdown" threat, and problem is not how CCleaner "works"?

6

Yes these are nothing whatsoever to do with CCleaner - Other than the fact that they have 'stolen' the name to try and fool people into thinking they are downloading CCleaner (or whatever other programme name they have chosen to steal/use).

What you are actually getting is some malware that is pretending to be something else.

They only ever use the names of genuine software that many people will be downloading, to try and fool as many people as they can.

This is why you should only download software from the 'official' site(s) for that software, and not from any sharing sites.

7

Ok, thank you

8

Also CCleaner versions are posted in the Announcements area of the forum, and shortly afterwards usually a few hours later the setup file checksums/hashes are edited into the announcement post so that people can very easily verify their download.

As an example: CCleaner v5.61 announcement.

9

As per the above, confirming that this has nothing whatsoever to do with CCleaner. Protips:

  1. Always download Piriform desktop programs from ccleaner.com
  2. When Googling, you want "CCleaner" (two Cs) not "CC Cleaner" or other misspellings (these are often grabbed by fakes that may run for a while before our legal team swats them)
  3. Downloading from pirate and crack websites is just asking for trouble. We know that some people can't afford to buy - that's why we have free versions of all of our software.
  4. "Unlimited lifetime licences" sold on eBay, etc for prices that are "too good to be true" are ... well ... too good to be true.
10
3 hours ago, Andavari said: 
<div class="ipsQuote_contents">
	<p>
		Also CCleaner versions are posted in the <strong><a href="<___base_url___>/forum/5-announcements/" rel="">Announcements</a></strong> area of the forum, and shortly afterwards usually a few hours later the setup file checksums/hashes are edited into the announcement post so that people can very easily verify their download.
	</p>

	<p>
		As an example: <a href="<___base_url___>/topic/54650-ccleaner-v5617392/" rel="">CCleaner v5.61 announcement</a>.
	</p>
</div>

@Andavari , hi, how you do checksums/hashes verification.

11

You need a checksum/hash tool program, those listed below I've tried and liked:

* Implbits HashTab Personal (Free, Installation): http://implbits.com/products/hashtab/

* Nirsoft HashMyFiles (Free, Portable): https://www.nirsoft.net/utils/hash_my_files.html

* Snap MD5: (Free, Portable): https://dan.hersam.com/software/snap-md5/

Nirsoft HashMyFiles is the most up-to-date!

12

@Andavari, thank you